I don't know about injecting the security context, it's kind of a bad practice (cannot be reused in console, with another user, etc.). User should be injected manually at the method level.